oss/excalidraw
1
0
Fork 0
Code Issues 1 Pull requests 3 Projects Releases Packages Wiki Activity Actions

fix(deps): update dependency nanoid to v3.3.18 [security] #7

Merged
oss merged 1 commit from renovate/npm-nanoid-vulnerability into selfhost 2026-11-14 20:59:13 +01:00
Conversation 0 Commits 1 Files changed 2 +5 -5
renovate-bot commented 2026-11-06 04:06:12 +01:00
Collaborator
Copy link

This PR contains the following updates:

Package Change Age Confidence
nanoid 3.3.3 → 3.3.18 age confidence

Predictable results in nanoid generation when given non-integer values

CVE-2024-55565 / GHSA-mwcw-c2x4-8c55

More information

Details

When nanoid is called with a fractional value, there were a number of undesirable effects:

  1. in browser and non-secure, the code infinite loops on while (size--)
  2. in node, the value of poolOffset becomes fractional, causing calls to nanoid to return zeroes until the pool is next filled
  3. if the first call in node is a fractional argument, the initial buffer allocation fails with an error

Version 3.3.8 and 5.0.9 are fixed.

Severity

  • CVSS Score: 4.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

nanoid: Integer Overflow or Wraparound

CVE-2026-73086 / GHSA-xwg4-73v4-xw9w

More information

Details

Summary

An integer overflow in nanoid(size) permanently corrupts the process-wide CSPRNG pool, causing all subsequent ID generation to return the deterministic string "uuuuuuuuuuuuuuuuuuuuu". Any application that passes user-influenced values to the size parameter loses all randomness guarantees for session tokens, CSRF tokens, and unique identifiers until process restart.

Details

nanoid() at index.js:101 coerces the size parameter with size |= 0, which converts it to a signed 32-bit integer. When size >= 2^31 (e.g., 2147483648), this wraps to -2147483648.

The negative value is passed to fillPool() (index.js:15):

function fillPool(bytes) {
  if (!pool || pool.length < bytes) {       // false: pool exists, -2B < pool.length
    pool = Buffer.allocUnsafe(bytes * POOL_SIZE_MULTIPLIER)
    crypto.getRandomValues(pool)
    poolOffset = 0
  } else if (poolOffset + bytes > pool.length) {  // false: poolOffset + (-2B) < pool.length
    crypto.getRandomValues(pool)
    poolOffset = 0
  }
  poolOffset += bytes  // poolOffset += -2147483648 → deeply negative
}

Neither branch triggers, so the pool is never refreshed. poolOffset becomes ~-2.1 billion.

Subsequent nanoid() calls execute:

for (let i = poolOffset - size; i < poolOffset; i++) {
  id += scopedUrlAlphabet[pool[i] & 63]
}

pool[negative_index] returns undefined. undefined & 63 evaluates to 0. urlAlphabet[0] is 'u'. Every ID becomes "uuuuuuuuuuuuuuuuuuuuu".

The corruption is persistent — it affects all subsequent calls in the process until ~100 million calls eventually wrap poolOffset back to positive, or the process restarts.

PoC
import { nanoid } from 'nanoid'

// Step 1: Normal operation
console.log(nanoid())  // e.g., "V1StGXR8_Z5jdHi6B-myT"

// Step 2: Trigger overflow (e.g., from an API parameter)
try { nanoid(2147483648) } catch(e) {}

// Step 3: All subsequent IDs are deterministic
console.log(nanoid())  // "uuuuuuuuuuuuuuuuuuuuu"
console.log(nanoid())  // "uuuuuuuuuuuuuuuuuuuuu"
console.log(nanoid())  // "uuuuuuuuuuuuuuuuuuuuu"
// ... forever, process-wide

Run with: node --experimental-vm-modules poc.mjs

Attack scenario: Any API endpoint that accepts a user-controlled length/size parameter (URL shortener slug length, configurable token size, etc.) and passes it to nanoid(userInput).

Impact

Complete loss of ID unpredictability and uniqueness, process-wide, from a single request.

  • All session IDs, CSRF tokens, API keys, and database identifiers generated after the attack are identical and predictable
  • An attacker can predict all tokens issued to other users, enabling session hijacking and authentication bypass
  • The corruption is persistent (survives across requests) and affects all consumers of nanoid in the same process
  • No special privileges or preconditions required — a single unauthenticated request is sufficient
  • Affects any application that passes external input to the size parameter without validation

Severity

  • CVSS Score: 7.4 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

nanoid: non-secure generators can loop indefinitely with negative size

CVE-2026-67214 / GHSA-28wg-ghj8-5hjv

More information

Details

nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.

Severity

  • CVSS Score: 8.2 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

nanoid: custom generators can loop indefinitely when size is zero

CVE-2026-67213 / GHSA-2v37-7h3g-55p8

More information

Details

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.

Severity

  • CVSS Score: 8.2 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

ai/nanoid (nanoid)

v3.3.18

Compare Source

v3.3.17

Compare Source

  • Fixed infinite loop on zero size.

v3.3.16

Compare Source

v3.3.15

Compare Source

  • Fixed npm provenance error.

v3.3.14

Compare Source

  • Fixed random pool corruption on big ID sizes.

v3.3.13

Compare Source

  • Reduced npm package size.

v3.3.12

Compare Source

  • Fixed breaking Nano ID by requesting big ID.

v3.3.11

Compare Source

  • Fixed React Native support.

v3.3.10

Compare Source

v3.3.9

Compare Source

  • Reduced npm package size.

v3.3.8

Compare Source

  • Fixed a way to break Nano ID by passing non-integer size (by @​myndzi).

v3.3.7

Compare Source

  • Fixed node16 TypeScript support (by Saadi Myftija).

v3.3.6

Compare Source

  • Fixed package.

v3.3.5

Compare Source

  • Backport funding information.

v3.3.4

Compare Source

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [nanoid](https://github.com/ai/nanoid) | [`3.3.3` → `3.3.18`](https://renovatebot.com/diffs/npm/nanoid/3.3.3/3.3.18) | ![age](https://developer.mend.io/api/mc/badges/age/npm/nanoid/3.3.18?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/nanoid/3.3.3/3.3.18?slim=true) | --- ### Predictable results in nanoid generation when given non-integer values [CVE-2024-55565](https://nvd.nist.gov/vuln/detail/CVE-2024-55565) / [GHSA-mwcw-c2x4-8c55](https://github.com/advisories/GHSA-mwcw-c2x4-8c55) <details> <summary>More information</summary> #### Details When nanoid is called with a fractional value, there were a number of undesirable effects: 1. in browser and non-secure, the code infinite loops on while (size--) 2. in node, the value of poolOffset becomes fractional, causing calls to nanoid to return zeroes until the pool is next filled 3. if the first call in node is a fractional argument, the initial buffer allocation fails with an error Version 3.3.8 and 5.0.9 are fixed. #### Severity - CVSS Score: 4.3 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2024-55565](https://nvd.nist.gov/vuln/detail/CVE-2024-55565) - [https://github.com/ai/nanoid/pull/510](https://github.com/ai/nanoid/pull/510) - [https://github.com/ai/nanoid](https://github.com/ai/nanoid) - [https://github.com/ai/nanoid/compare/3.3.7...3.3.8](https://github.com/ai/nanoid/compare/3.3.7...3.3.8) - [https://github.com/ai/nanoid/releases/tag/5.0.9](https://github.com/ai/nanoid/releases/tag/5.0.9) - [https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html](https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html) - [https://lists.debian.org/debian-lts-announce/2025/01/msg00006.html](https://lists.debian.org/debian-lts-announce/2025/01/msg00006.html) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-mwcw-c2x4-8c55) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### nanoid: Integer Overflow or Wraparound [CVE-2026-73086](https://nvd.nist.gov/vuln/detail/CVE-2026-73086) / [GHSA-xwg4-73v4-xw9w](https://github.com/advisories/GHSA-xwg4-73v4-xw9w) <details> <summary>More information</summary> #### Details ##### Summary An integer overflow in `nanoid(size)` permanently corrupts the process-wide CSPRNG pool, causing all subsequent ID generation to return the deterministic string `"uuuuuuuuuuuuuuuuuuuuu"`. Any application that passes user-influenced values to the `size` parameter loses all randomness guarantees for session tokens, CSRF tokens, and unique identifiers until process restart. ##### Details `nanoid()` at [`index.js:101`](https://github.com/ai/nanoid/blob/main/index.js#L101) coerces the `size` parameter with `size |= 0`, which converts it to a signed 32-bit integer. When `size >= 2^31` (e.g., `2147483648`), this wraps to `-2147483648`. The negative value is passed to `fillPool()` ([`index.js:15`](https://github.com/ai/nanoid/blob/main/index.js#L15)): ```javascript function fillPool(bytes) { if (!pool || pool.length < bytes) { // false: pool exists, -2B < pool.length pool = Buffer.allocUnsafe(bytes * POOL_SIZE_MULTIPLIER) crypto.getRandomValues(pool) poolOffset = 0 } else if (poolOffset + bytes > pool.length) { // false: poolOffset + (-2B) < pool.length crypto.getRandomValues(pool) poolOffset = 0 } poolOffset += bytes // poolOffset += -2147483648 → deeply negative } ``` Neither branch triggers, so the pool is never refreshed. `poolOffset` becomes ~-2.1 billion. Subsequent `nanoid()` calls execute: ```javascript for (let i = poolOffset - size; i < poolOffset; i++) { id += scopedUrlAlphabet[pool[i] & 63] } ``` `pool[negative_index]` returns `undefined`. `undefined & 63` evaluates to `0`. `urlAlphabet[0]` is `'u'`. Every ID becomes `"uuuuuuuuuuuuuuuuuuuuu"`. The corruption is **persistent** — it affects all subsequent calls in the process until ~100 million calls eventually wrap `poolOffset` back to positive, or the process restarts. ##### PoC ```javascript import { nanoid } from 'nanoid' // Step 1: Normal operation console.log(nanoid()) // e.g., "V1StGXR8_Z5jdHi6B-myT" // Step 2: Trigger overflow (e.g., from an API parameter) try { nanoid(2147483648) } catch(e) {} // Step 3: All subsequent IDs are deterministic console.log(nanoid()) // "uuuuuuuuuuuuuuuuuuuuu" console.log(nanoid()) // "uuuuuuuuuuuuuuuuuuuuu" console.log(nanoid()) // "uuuuuuuuuuuuuuuuuuuuu" // ... forever, process-wide ``` Run with: `node --experimental-vm-modules poc.mjs` Attack scenario: Any API endpoint that accepts a user-controlled length/size parameter (URL shortener slug length, configurable token size, etc.) and passes it to `nanoid(userInput)`. ##### Impact **Complete loss of ID unpredictability and uniqueness, process-wide, from a single request.** - All session IDs, CSRF tokens, API keys, and database identifiers generated after the attack are identical and predictable - An attacker can predict all tokens issued to other users, enabling session hijacking and authentication bypass - The corruption is persistent (survives across requests) and affects all consumers of `nanoid` in the same process - No special privileges or preconditions required — a single unauthenticated request is sufficient - Affects any application that passes external input to the `size` parameter without validation #### Severity - CVSS Score: 7.4 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N` #### References - [https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w](https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w) - [https://nvd.nist.gov/vuln/detail/CVE-2026-73086](https://nvd.nist.gov/vuln/detail/CVE-2026-73086) - [https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4](https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4) - [https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3](https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3) - [https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac](https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac) - [https://github.com/ai/nanoid](https://github.com/ai/nanoid) - [https://github.com/ai/nanoid/releases/tag/3.3.12](https://github.com/ai/nanoid/releases/tag/3.3.12) - [https://github.com/ai/nanoid/releases/tag/5.1.11](https://github.com/ai/nanoid/releases/tag/5.1.11) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-xwg4-73v4-xw9w) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### nanoid: non-secure generators can loop indefinitely with negative size [CVE-2026-67214](https://nvd.nist.gov/vuln/detail/CVE-2026-67214) / [GHSA-28wg-ghj8-5hjv](https://github.com/advisories/GHSA-28wg-ghj8-5hjv) <details> <summary>More information</summary> #### Details nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition. #### Severity - CVSS Score: 8.2 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2026-67214](https://nvd.nist.gov/vuln/detail/CVE-2026-67214) - [https://github.com/ai/nanoid/pull/600](https://github.com/ai/nanoid/pull/600) - [https://github.com/ai/nanoid/pull/601](https://github.com/ai/nanoid/pull/601) - [https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49](https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49) - [https://github.com/ai/nanoid/commit/e835c9b71eab832bc6106944bdd26ea96cf2c66d](https://github.com/ai/nanoid/commit/e835c9b71eab832bc6106944bdd26ea96cf2c66d) - [https://github.com/ai/nanoid](https://github.com/ai/nanoid) - [https://github.com/ai/nanoid/releases/tag/5.1.16](https://github.com/ai/nanoid/releases/tag/5.1.16) - [https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module](https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-28wg-ghj8-5hjv) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### nanoid: custom generators can loop indefinitely when size is zero [CVE-2026-67213](https://nvd.nist.gov/vuln/detail/CVE-2026-67213) / [GHSA-2v37-7h3g-55p8](https://github.com/advisories/GHSA-2v37-7h3g-55p8) <details> <summary>More information</summary> #### Details nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition. #### Severity - CVSS Score: 8.2 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2026-67213](https://nvd.nist.gov/vuln/detail/CVE-2026-67213) - [https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7](https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7) - [https://github.com/ai/nanoid/commit/e10f8d40ce9d1ab47f66d65a16b48086432730d0](https://github.com/ai/nanoid/commit/e10f8d40ce9d1ab47f66d65a16b48086432730d0) - [https://github.com/ai/nanoid/commit/f9d13f150847d117877adee3460a46eceb0cf49b](https://github.com/ai/nanoid/commit/f9d13f150847d117877adee3460a46eceb0cf49b) - [https://github.com/ai/nanoid](https://github.com/ai/nanoid) - [https://github.com/ai/nanoid/releases/tag/3.3.17](https://github.com/ai/nanoid/releases/tag/3.3.17) - [https://github.com/ai/nanoid/releases/tag/3.3.18](https://github.com/ai/nanoid/releases/tag/3.3.18) - [https://github.com/ai/nanoid/releases/tag/5.1.6](https://github.com/ai/nanoid/releases/tag/5.1.6) - [https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom](https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-2v37-7h3g-55p8) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>ai/nanoid (nanoid)</summary> ### [`v3.3.18`](https://github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#3318) [Compare Source](https://github.com/ai/nanoid/compare/3.3.17...3.3.18) - Fixed infinite loop on async for React Native (by [@&#8203;OvergrowthBeards-JB](https://github.com/OvergrowthBeards-JB)). ### [`v3.3.17`](https://github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#3317) [Compare Source](https://github.com/ai/nanoid/compare/3.3.16...3.3.17) - Fixed infinite loop on zero size. ### [`v3.3.16`](https://github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#3316) [Compare Source](https://github.com/ai/nanoid/compare/3.3.15...3.3.16) - Fixed infinite loop on negative size (by [@&#8203;greymoth-jp](https://github.com/greymoth-jp)). ### [`v3.3.15`](https://github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#3315) [Compare Source](https://github.com/ai/nanoid/compare/3.3.14...3.3.15) - Fixed npm provenance error. ### [`v3.3.14`](https://github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#3314) [Compare Source](https://github.com/ai/nanoid/compare/3.3.13...3.3.14) - Fixed random pool corruption on big ID sizes. ### [`v3.3.13`](https://github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#3313) [Compare Source](https://github.com/ai/nanoid/compare/3.3.12...3.3.13) - Reduced npm package size. ### [`v3.3.12`](https://github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#3312) [Compare Source](https://github.com/ai/nanoid/compare/3.3.11...3.3.12) - Fixed breaking Nano ID by requesting big ID. ### [`v3.3.11`](https://github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#3311) [Compare Source](https://github.com/ai/nanoid/compare/3.3.10...3.3.11) - Fixed React Native support. ### [`v3.3.10`](https://github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#3310) [Compare Source](https://github.com/ai/nanoid/compare/3.3.9...3.3.10) - Fixed React Native support (by [@&#8203;steida](https://github.com/steida)). ### [`v3.3.9`](https://github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#339) [Compare Source](https://github.com/ai/nanoid/compare/3.3.8...3.3.9) - Reduced npm package size. ### [`v3.3.8`](https://github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#338) [Compare Source](https://github.com/ai/nanoid/compare/3.3.7...3.3.8) - Fixed a way to break Nano ID by passing non-integer size (by [@&#8203;myndzi](https://github.com/myndzi)). ### [`v3.3.7`](https://github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#337) [Compare Source](https://github.com/ai/nanoid/compare/3.3.6...3.3.7) - Fixed `node16` TypeScript support (by Saadi Myftija). ### [`v3.3.6`](https://github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#336) [Compare Source](https://github.com/ai/nanoid/compare/3.3.5...3.3.6) - Fixed package. ### [`v3.3.5`](https://github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#335) [Compare Source](https://github.com/ai/nanoid/compare/3.3.4...3.3.5) - Backport funding information. ### [`v3.3.4`](https://github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#334) [Compare Source](https://github.com/ai/nanoid/compare/3.3.3...3.3.4) - Fixed `--help` in CLI (by [@&#8203;Lete114](https://github.com/Lete114)). </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yMjEuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjIyMS4xIiwidGFyZ2V0QnJhbmNoIjoic2VsZmhvc3QiLCJsYWJlbHMiOltdfQ==-->
fix(deps): update dependency nanoid to v3.3.18 [security]
Some checks failed
upkeep / dispatch (pull_request_target) Failing after 30m9s
Details
73c50af05b
oss merged commit bed6f5897c into selfhost 2026-11-14 20:59:13 +01:00
oss deleted branch renovate/npm-nanoid-vulnerability 2026-11-14 20:59:14 +01:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
oss/excalidraw!7
No description provided.